jeremi · Nov 6, 2026 · Nov 6, 2026
diff --git a/.env.example b/.env.example
@@ -13,14 +13,3 @@ NAGDI_RELAY_CURSOR_KEY=
 CHILD_BENEFIT_FEDERATOR_TOKEN=
 SOLMARA_EVIDENCE_CLIENT_KEY=/absolute/path/to/solmara-lab/config/evidence/local/cells/mint/clients/solmara-demo-client-key
 PORTAL_SESSION_SECRET=
-PORTAL_AUTH_PROVIDER=mock
-
-# Optional local eSignet profile.
-SOLMARA_ESIGNET_POSTGRES_PASSWORD=
-NIA_ESIGNET_CLIENT_PRIVATE_JWK=
-REGISTRY_ESIGNET_KYC_KEYSTORE_PASSWORD=
-REGISTRY_ESIGNET_KYC_TOKEN_SECRET=
-REGISTRY_ESIGNET_PSUT_SECRET=
-PORTAL_ESIGNET_CLIENT_ID=solmara-portal
-PORTAL_ESIGNET_CLIENT_KEY_ID=solmara-portal-key-1
-PORTAL_ESIGNET_CLIENT_PRIVATE_KEY_B64=
diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
@@ -33,13 +33,11 @@ jobs:
           printf 'source_commit=%s\n' "$REGISTRY_STACK_SOURCE_COMMIT" >> "$GITHUB_OUTPUT"
           for key in REGISTRY_STACK_REQUIRED_VERSION \
             REGISTRY_RELAY_IMAGE SOLMARA_EVIDENCE_IMAGE SOLMARA_MINT_IMAGE \
-            ESIGNET_BASE_IMAGE ESIGNET_POSTGRES_IMAGE ESIGNET_UI_IMAGE \
-            ESIGNET_AUTHENTICATOR_JAR_URL ESIGNET_AUTHENTICATOR_JAR_SHA256 \
             REGISTRY_STACK_RELEASE_RELAYCTL_ASSET_URL REGISTRY_STACK_RELEASE_RELAYCTL_ASSET_SHA256; do
             value="$(printenv "$key")"
             printf '%s=%s\n' "$key" "$value" >> "$GITHUB_ENV"
           done
-      - name: Require published Registry Stack and authenticator pins
+      - name: Require published Registry Stack pins
         run: scripts/check-registry-stack-release-pin.py --require-public
       - name: Checkout the exact Registry Stack source
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -388,51 +386,6 @@ jobs:
           platforms: linux/amd64
           push: true
           tags: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-portal:${{ env.SOLMARA_IMAGE_TAG }}
-      - name: Build and push eSignet Relay V2 authenticator image
-        id: esignet_relay
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          file: docker/esignet-relay/Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-relay:${{ env.SOLMARA_IMAGE_TAG }}
-          build-args: |
-            ESIGNET_BASE_IMAGE=${{ env.ESIGNET_BASE_IMAGE }}
-            ESIGNET_AUTHENTICATOR_JAR_URL=${{ env.ESIGNET_AUTHENTICATOR_JAR_URL }}
-            ESIGNET_AUTHENTICATOR_JAR_SHA256=${{ env.ESIGNET_AUTHENTICATOR_JAR_SHA256 }}
-      - name: Build and push isolated eSignet database
-        id: esignet_postgres
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          file: docker/esignet-postgres/Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-postgres:${{ env.SOLMARA_IMAGE_TAG }}
-          build-args: |
-            POSTGRES_IMAGE=${{ env.ESIGNET_POSTGRES_IMAGE }}
-      - name: Build and push eSignet UI
-        id: esignet_ui
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          file: docker/esignet-ui/Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-ui:${{ env.SOLMARA_IMAGE_TAG }}
-          build-args: |
-            ESIGNET_UI_IMAGE=${{ env.ESIGNET_UI_IMAGE }}
-            ESIGNET_NGINX_CONF=config/esignet/nginx-hosted.conf
-      - name: Build and push eSignet seed image
-        id: esignet_seed
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          file: docker/esignet-seed/Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-seed:${{ env.SOLMARA_IMAGE_TAG }}
       - name: Generate Coolify image manifest
         env:
           REGISTRY_RELAY_IMAGE: ${{ env.REGISTRY_RELAY_IMAGE }}
@@ -444,10 +397,6 @@ jobs:
           SOLMARA_SCENARIO_RUNNER_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-scenario-runner@${{ steps.scenario_runner.outputs.digest }}
           SOLMARA_HOME_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-home@${{ steps.home.outputs.digest }}
           SOLMARA_PORTAL_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-portal@${{ steps.portal.outputs.digest }}
-          SOLMARA_ESIGNET_RELAY_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-relay@${{ steps.esignet_relay.outputs.digest }}
-          SOLMARA_ESIGNET_POSTGRES_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-postgres@${{ steps.esignet_postgres.outputs.digest }}
-          SOLMARA_ESIGNET_UI_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-ui@${{ steps.esignet_ui.outputs.digest }}
-          SOLMARA_ESIGNET_SEED_IMAGE: ${{ env.SOLMARA_IMAGE_REGISTRY }}/solmara-lab-esignet-seed@${{ steps.esignet_seed.outputs.digest }}
         run: |
           set -euo pipefail
           manifest="$RUNNER_TEMP/solmara-release/solmara-hosted-images.env"

diff --git a/README.md b/README.md
@@ -13,8 +13,8 @@ The reset has two evidence cadences:
 
 Six Evidence gateways have distinct providers, issuers, signing keys, JWKS, audit
 sinks, subject-binding secrets, and endpoints. Five Relays expose only the
-named non-enumerating operations needed by the lab. NIA's Relay is reserved for
-the optional eSignet UserInfo profile; NIA Evidence reads its own extract.
+named non-enumerating operations needed by the lab. NIA's Relay serves one
+exact lookup that no lab client calls; NIA Evidence reads its own extract.
 
 ## Release prerequisite
 
@@ -30,9 +30,7 @@ official OCI references by digest, and the `relayctl` binary checksum in
 same full references without reconstructing them from a second deployment
 input.
 
-The eSignet profile uses the separately released
-`esignet-relay-authenticator` v0.2.0 JAR and its matching SHA-256 checksum. No
-source-build, locally wrapped runtime, floating-tag, or v0.19 compatibility
+No source-build, locally wrapped runtime, floating-tag, or v0.19 compatibility
 fallback is accepted.
 
 ## Quick start
@@ -72,7 +70,7 @@ never assumes a national Evidence host.
 | Authority | Evidence source | Relay V2 role |
 |---|---|---|
 | CRA | immutable birth extract; Relay for death and civil link | `civil-person/death-by-uin`, `civil-person/citizen-link-by-uin` |
-| NIA | immutable population extract | `population-person/esignet-userinfo` for eSignet |
+| NIA | immutable population extract | `population-person/esignet-userinfo` (retained; no lab client calls it) |
 | SRO | immutable poverty extract | none |
 | MoSD | Relay lookup | `beneficiary-enrolment/by-uin` |
 | SIPF | Relay lookups | `pension-payment/by-pensioner-uin`, `survivor-case/by-spouse-uin` |
@@ -115,13 +113,12 @@ just relay-check          # relayctl check --production, generate, test, package
 just evidence-check       # six bundles, 11 requirements, source/error fixtures
 just lint                 # metadata, redaction, portal and Visitor Center checks
 just test                 # Python and web unit/integration suites
-just compose              # local, hosted, Coolify, and optional eSignet config
+just compose              # local, hosted, and Coolify config
 just smoke                # local UI and Relay health
 just programme-acceptance # programme stories and generic denial controls
 just lifecycle-proof      # live Relay and immutable-extract cadence
 just portal-live-e2e
 just home-live-e2e
-just smoke-esignet        # optional NIA Relay V2 login profile
 ```
 
 Generated SQLite databases, Relay packages, runtime bundles, keys, secrets,

diff --git a/compose.coolify.esignet.yaml b/compose.coolify.esignet.yaml
diff --git a/compose.coolify.provision.yaml b/compose.coolify.provision.yaml
@@ -136,7 +136,6 @@ services:
       - {source: sipf-survivor-evidence-client-public-jwk, target: /tmp/solmara-provisioning/sipf-survivor-evidence-public.jwk, uid: "0", gid: "0", mode: 0400}
       - {source: nagdi-voucher-evidence-client-public-jwk, target: /tmp/solmara-provisioning/nagdi-voucher-evidence-public.jwk, uid: "0", gid: "0", mode: 0400}
       - {source: nagdi-livestock-evidence-client-public-jwk, target: /tmp/solmara-provisioning/nagdi-livestock-evidence-public.jwk, uid: "0", gid: "0", mode: 0400}
-      - {source: nia-esignet-client-public-jwk, target: /tmp/solmara-provisioning/nia-esignet-public.jwk, uid: "0", gid: "0", mode: 0400}
       - {source: solmara-demo-client-public-jwk, target: /tmp/solmara-provisioning/solmara-demo-client-public.jwk, uid: "0", gid: "0", mode: 0400}
 
   provisioning-ready:
@@ -198,5 +197,4 @@ secrets:
   sipf-survivor-evidence-client-public-jwk: {environment: SIPF_SURVIVOR_EVIDENCE_CLIENT_PUBLIC_JWK}
   nagdi-voucher-evidence-client-public-jwk: {environment: NAGDI_VOUCHER_EVIDENCE_CLIENT_PUBLIC_JWK}
   nagdi-livestock-evidence-client-public-jwk: {environment: NAGDI_LIVESTOCK_EVIDENCE_CLIENT_PUBLIC_JWK}
-  nia-esignet-client-public-jwk: {environment: NIA_ESIGNET_CLIENT_PUBLIC_JWK}
   solmara-demo-client-public-jwk: {environment: SOLMARA_DEMO_CLIENT_PUBLIC_JWK}
diff --git a/compose.coolify.yaml b/compose.coolify.yaml
@@ -138,19 +138,7 @@ services:
     environment:
       <<: *hosted-evidence
       PORTAL_PROVIDER: live
-      PORTAL_AUTH_PROVIDER: ${PORTAL_AUTH_PROVIDER:-mock}
       PORTAL_SECURE_COOKIES: "true"
-      PORTAL_ESIGNET_CLIENT_ID: ${PORTAL_ESIGNET_CLIENT_ID:-solmara-portal}
-      PORTAL_ESIGNET_CLIENT_KEY_ID: ${PORTAL_ESIGNET_CLIENT_KEY_ID:-solmara-portal-key-1}
-      PORTAL_ESIGNET_CLIENT_PRIVATE_KEY_B64: ${PORTAL_ESIGNET_CLIENT_PRIVATE_KEY_B64:-}
-      PORTAL_ESIGNET_ISSUER: ${SOLMARA_ESIGNET_PUBLIC_BASE_URL:-https://esignet.solmara.registrystack.org}
-      PORTAL_ESIGNET_AUTHORIZATION_ENDPOINT: ${SOLMARA_ESIGNET_UI_PUBLIC_BASE_URL:-https://esignet-ui.solmara.registrystack.org}/authorize
-      PORTAL_ESIGNET_TOKEN_ENDPOINT: ${SOLMARA_ESIGNET_PUBLIC_BASE_URL:-https://esignet.solmara.registrystack.org}/v1/esignet/oauth/v2/token
-      PORTAL_ESIGNET_CLIENT_ASSERTION_AUDIENCE: ${SOLMARA_ESIGNET_PUBLIC_BASE_URL:-https://esignet.solmara.registrystack.org}/v1/esignet/oauth/v2/token
-      PORTAL_ESIGNET_USERINFO_ENDPOINT: ${SOLMARA_ESIGNET_PUBLIC_BASE_URL:-https://esignet.solmara.registrystack.org}/v1/esignet/oidc/userinfo
-      PORTAL_ESIGNET_REDIRECT_URI: ${SOLMARA_PORTAL_PUBLIC_BASE_URL:-https://portal.solmara.registrystack.org}/auth/callback
-      PORTAL_ESIGNET_SCOPE: openid profile
-      PORTAL_ESIGNET_SUBJECT_CLAIM: sub
       SCENARIO_RUNNER_URL: ${SOLMARA_SCENARIO_RUNNER_PUBLIC_BASE_URL:-https://scenarios.solmara.registrystack.org}
       CHILD_BENEFIT_FEDERATOR_URL: ${SOLMARA_CHILD_BENEFIT_FEDERATOR_PUBLIC_BASE_URL:-https://child-benefit.solmara.registrystack.org}
     secrets: